catalog/.github/workflows/validate.yml at main · existential-engineering/catalog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: Validate

on:
  push:
    branches: [main]
    paths:
      - "data/**"
      - "schema/**"
      - "scripts/**"
      # Dependency manifests trigger the audit job below. Without these a
      # renovate PR gets no Validate run at all, so a bump that breaks tsx,
      # vitest or better-sqlite3 only surfaces on the next data PR.
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - ".github/workflows/validate.yml"
  # Keep these paths in sync with the push trigger above. `labeled` and
  # `unlabeled` are listed because the ID immutability step reads the
  # `retirement` label: without them a maintainer adding the label gets
  # no new run, and a re-run keeps the original payload.
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
    branches: [main]
    paths:
      - "data/**"
      - "schema/**"
      - "scripts/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - ".github/workflows/validate.yml"

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Test
        run: pnpm test

      - name: Type check
        run: pnpm typecheck

      - name: Validate YAML files
        run: pnpm validate

      - name: Validate translations
        run: pnpm validate:translations

      - name: Check JSON schemas are up to date
        run: |
          pnpm generate:schemas
          git diff --exit-code schema/json/ || (echo "::error::JSON schemas are out of date. Run 'pnpm generate:schemas' and commit the results." && exit 1)

      - name: Check CONTEXT.md is up to date
        run: |
          pnpm generate:context
          git diff --exit-code schema/CONTEXT.md || (echo "::error::schema/CONTEXT.md is out of date. Run 'pnpm generate:context' and commit the result." && exit 1)

      - name: Check formatting
        run: pnpm format:check

      # An id may leave the catalog only on purpose: the check fails a
      # deletion or a rename that drops an id unless the pull request
      # carries the `retirement` label. The labels reach the script through
      # env, never `${{ }}` inside `run:`, since a label name is text
      # somebody typed.
      - name: Check ID immutability
        if: github.event_name == 'pull_request'
        env:
          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
        run: pnpm exec tsx scripts/check-id-immutability.ts origin/main

      # `pnpm assign-ids` owns `id` and `io[].key`, and the build refuses an
      # entry missing either. This workflow and assign-ids.yml both fire on
      # `pull_request` and run in parallel, so the tree checked out here is
      # the one BEFORE that workflow's patch lands: without this step the
      # test build below fails on any pull request that adds an entry or a
      # port, and only passes on the re-run after the patch is pushed.
      # Nothing is committed here — the assignment is local to the runner,
      # so this makes the test build self-sufficient without taking any
      # write permission. assign-ids.yml stays the thing that actually
      # writes the keys to the branch (AUREO-705).
      - name: Assign ids and io keys (local, not committed)
        run: pnpm assign-ids

      - name: Build database (test)
        run: pnpm build 0

  # Kept out of the validate job on purpose. `pnpm audit` goes red when an
  # advisory is published upstream, with no change to this repo. As the first
  # step of a single job it skipped every data check behind it, so the Validate
  # check was red on every open PR regardless of content (AUREO-781). Running it
  # as its own job means a fresh advisory blocks dependency hygiene without ever
  # masking whether the catalog data itself is valid.
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Audit dependencies
        run: pnpm audit --audit-level=high